Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn morePlaintextPasswordEncoder authenticates encoded passwords that are null
Description
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of “null”.
Affected Spring Products and Versions
Spring Security:
- 4.2.12 and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 4.2.13 | OSS |
No further mitigation steps are necessary.
Credit
This issue was identified and responsibly reported by Tim Büthe and Daniel Neagaru from mytaxi.
History
- 2019-06-19: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all